Can Bitcoin actually get private transactions without a fork?

[OsaiEmma]

Saw this Shielded Bitcoin proposal yesterday. So they’re trying to bring much stronger privacy to BTC without a soft fork or separate chain. That alone makes it worth watching imo.

Still early though. The in/out part isn’t fully solved yet, and some transaction details can still leak from the outside. So I definitely wouldn’t say “private Bitcoin is solved” yet.

But if this actually works well, I do wonder what happens to the privacy coin narrative. If BTC can get good enough privacy without changing the base layer too much, that’s a pretty big deal.

Would you use shielded BTC yourself?

And do you think Bitcoin should push further into privacy, or is that better left to separate coins?

There is a subtle difference between transparency and privacy though. I know they somewhat sound like opposites, but....they aren't necessarily opposite. I guess the main reason why it feels like there isn't privacy due to the transparency of Bitcoin is because of how we off-ramp, and the utilization of those centralized/non-custodial exchange that requires KYC data; if not these, I think the block chain is somewhat private but pseudonymous—depending on how it is being used—for identity privacy.

I guess this proposal aims at completely separating these two parts of the coin and removing Bitcoin utility from that gray area which is not entirely a bad thing, but let's look at the nitty-gritty of the whole thing:

Since this will be a new protocol, there will be a relatively small pool of users, and this can undermine the core essence of the protocol. Since it aims at improving privacy and move usage from the gray area of pseudonym to being more private. With a small pool of users, it won't be that difficult to link their transactions—I know this can be resolved with time when more users come in—but this will create a "chicken-and-egg effect": where you need more users to maintain full privacy, meanwhile those same users will need the protocol to be private in other to come in.

[FinneysTrueVision]

Shielded Bitcoin’s design reminds me in some ways of Railgun on Ethereum. Obviously, there are some notable differences due to the architecture of their respective blockchains. Railgun is the second most popular privacy protocol on Ethereum behind Tornado Cash, though its use still remains niche. It has not gained widespread adoption because of slow wallet sync times and not so great UX.

I think shielded Bitcoin will also struggle with adoption early on. If somebody builds a great user friendly wallet for it, like Samourai and Wasabi did for coinjoin, that could increase its popularity to similar levels as coinjoining.

Having more privacy options on Bitcoin is nice, but they always feel bolted on and come with certain tradeoffs. This is not as robust as having privacy by default at the protocol level. There’s also the challenge of funds interacting with the protocol automatically being flagged as tainted by some AML scoring systems. If you only care about privacy and avoid centralized platforms that might not be such a problem.

[denshin]

The in/out part isn't fully solved yet

thats the part id worry about too. a shielded pool only helps if lots of normal people use it, otherwise just entering it is a signal. meanwhile silent payments and payjoin already fix a good chunk without any fork and barely anyone uses them

[bitmover]

Forsyth Jones shared this image in another forum, showing a transaction in this shielded  bitcoin

https://x.com/BitsagaRob/status/2103463645153996897




Looks similar to LN, where balance changes happen off chain and later on to be settled.

[masulum]

I remember reading Satoshi Nakamoto's forum posts and getting the impression that he considered the issue of maintaining anonymity and privacy of Bitcoin transactions to be extremely important. However, at that time, this issue wasn't as pressing as it is now.🧖

Therefore, I strongly welcome the Shielded Bitcoin proposal. Yes, I know regulators won't like it... But who cares about regulators! The main thing is that Bitcoin remains as close to its original concept as possible, and for that, maintaining anonymity and privacy of transactions is crucial.

Bitcoin wasn’t created to be fully anonymous, but was designed to be pseudonymous. This is very different (IMO), even though transactions are private, transactions can still get tracked, but the owner remains unknown until the transaction ends up at a centralized exchange address. You might think that government regulators doesn’t matter to you, but this affects regulations and taxes for individuals because everyone who living in a country must pay a tax, if regulator rejected bitcoins, so it will affected to bitcoin status as investment instruments.

i think, if Bitcoin transactions were fully anonymous, this will threaten corporate holders, centralized exchanges (CEXs), ETFs, and other entities would remove Bitcoin from their investment portfolios because it will definitely not be allowed by the government. This may apply in all countries, especially countries that do not legally recognize Bitcoin in any way, including its status as an investment instrument. in the end, bitcoin price maybe plunged after blacklisted by regulators. but we will see, if bitcoin as pseudonym transaction not being replaced with fully private transaction, i think it will not affected too much.

[PERtua]

The adoption issue is interesting, to me. Making privacy sounds optional would be nice. But would be quite effective if it's used by a lot of people. But if a few people are using shielded transactions. The anonymity set may be limited. Making those transactions much easier to distinguish. So there is a technical design problem which may be half the problem. The adoption, usability, fees and wallet support may be as important. There are already privacy tools in the Bitcoin ecosystem, but the majority of users have not been using them regularly. I believe this is a practical aspect that's more important to watch than simply considering whether Bitcoin should be a privacy coin.

[stompix]

Forsyth Jones shared this image in another forum, showing a transaction in this shielded  bitcoin
https://x.com/BitsagaRob/status/2103463645153996897
Looks similar to LN, where balance changes happen off chain and later on to be settled.

It's not really shielded Bitcoin as in that proposal, he also mentioned this, it's a owner change, not a settlement.
Insanely complicated, heavy footprint 3 times the normal size, not really 100% anonymous.
The whole obfuscation this way would rely on volume and number of outputs, how do you do volume to hide that when the tx would be clogging the mempool?

Now, specifically talking about shielded Bitcoin, it will never gain traction, everyone will be scared of regulations, privacy or coins valued back at $1000, what do you think people will choose?

[AVE5]

Would you use shielded BTC yourself?

And do you think Bitcoin should push further into privacy, or is that better left to separate coins?

I don't think if there had been an error made from the bitcoin block chain that we should be craving for shielded bitcoin all just enhancement of privacy.
I understand truly the importance of privacy but let's not conclude too quick that privacies where transactions leaves no traced at the cost of spending the shielded bitcoin shouldn't be at most concerns when stumbling about security factors.
We should also consider reliable and efficient mechanism don't shouldn't be liable of complications in the long run.
Bitcoin as a decentralized crypto currency wasn't really made to keep total anonymity but pseudonymous.
So I don't see any threat about using the normal bitcoin block chain network where transaction address and figures transacted bitcoin is made public.
Its undoubtedly that the normal bitcoin networking mechanism do still prioritizes on users privacy. The rest risk on the operation relies on the user means of storing the bitcoin

[PrivacyG]

Another fork? Good luck with that.

It particularly mentions in the title and in the text written by OP that this would be with out a Fork,

So they’re trying to bring much stronger privacy to BTC without a soft fork or

[X-ray]

The proposal it's experimental
It looks like its more like having a shitcoin on bitcoin with the belief that it grants more privacy
Yeah it has it's own validation.
And to be honest one of the reasons the government don't outrightly consider bitcoin evil
If that's the word
It's because it's a public ledger
Pseudonymous but a slip and data could link one to an account.

Considering that the proposal for shielded transaction by design is closer to Zcash's privacy feature rather than to Monero and yet Zcash is listed everywhere and can get ETF issued, it should be fine.

The shielded transaction proposed isn't as strong as monero's which wouldn't give government reason to consider it evil and if they do, they simply hate crypto.

The wrench attack, KYC data breaches, and scams are enough to justify having shielded transactions, otherwise the government might be putting us in danger in favor of being "transparent".

[Leon Zimmer]

Forsyth Jones shared this image in another forum, showing a transaction in this shielded  bitcoin

https://x.com/BitsagaRob/status/2103463645153996897


Looks similar to LN, where balance changes happen off chain and later on to be settled.

What part of that block explorer output is unclear to you? You can plainly see the address the tx comes from, the address it's going to, and the USD values of each leg (2.53 in, 0.52 out).

This is a regular SegWit/Taproot tx that happens to include an unreadable OP_RETURN message. The tx is confirmed, on-chain. There's nothing "shielded" about this, and absolutely nothing even remotely similar to what happens with Lightning.

In order for this to be like Zcash "shielding", it would have to hide the sender, receiver, and value using zk-SNARKs at the protocol-level, not just tacking on some OP_RETURN data that might encode a message or perform some other application-layer function. In order for it to be like Lightning, the balance updates would need to happen off-chain, with base layer txs only happening when you're opening/closing a LN channel.

[yhiaali3]

Yes, that would be a great achievement if it happened, but it is still under study and experimentation, and we will not see the negative and positive results before the concept of "Shielded Bitcoin" is applied in reality.

In principle, as long as it is optional and does not require a separate chain or a soft or hard Fork of the Bitcoin network, it will be a good and profitable thing for miners who will get higher fees that help them continue in light of declining mining rewards.

But the biggest fear will be the stance of governments towards "Shielded Bitcoin" as it could be treated like mixed Bitcoin or like privacy currencies such as Monero and be banned.

[Tamaperdana]

Snip

Would you use shielded BTC yourself?

And do you think Bitcoin should push further into privacy, or is that better left to separate coins?

Making Bitcoin more private is certainly great, but for now, I personally don't pay much attention to it. Bitcoin's security is already quite good, and I'm already comfortable with the current system.

So, if Bitcoin could use a more private transaction system, yes, that would be great, and I might try it. However, Bitcoin's primary value for me right now is its store of value, and I don't think privacy is that bad either. Therefore, I'm personally less interested in it at this time.

I think Bitcoin is better off focusing on other, better things right now. But this is just my assumption, and everyone will undoubtedly have their own perspective on this. So, I hope everything related to Bitcoin goes smoothly. Because Bitcoin is clearly a miracle that has come to us all.

[athanred]

That alone makes it worth watching imo.

Not really. There are many things, which could be introduced in a no-fork way. However, it doesn't automatically make it worth watching, because guess what: if something requires no forks, and introduces new rules, which are not enforced by any old nodes, then it may be possible to make a transaction, which would be valid on Bitcoin, but invalid on some subnetwork. What then?

There is a reason, why for example Taproot is a soft-fork. In theory, you could make it a no-fork. By just committing to a signature, any additional code can be executed. So what? Old nodes wouldn't validate them anyway. And without having majority of miners on your side, stealing any "tapscript-over-public-key" coins would be trivial.

In exactly the same way, quantum signatures can be introduced without any soft-forks. And again: it doesn't matter, if new rules would be ignored by most miners, and any coin could be moved, by using a valid ECDSA signature, without any quantum data. Which is why a soft-fork is needed here anyway. And the same with "Shielded Bitcoin", or other "metaprotocols": they are unsafe in their current no-fork form.

So they’re trying to bring much stronger privacy to BTC without a soft fork or separate chain.

Technically, it is doable, just not in a way they are trying to make it. A better example of a working no-fork is 2P-ECDSA. Then, all old rules are preserved, but you can actually execute multisig on a single public key, without introducing Schnorr signatures, or other things like that.

Another good example is CoinJoin, where existing protocol is fully followed, but it is hard to guess, who owns what. Which means there are some solutions, where you can improve privacy in a no-fork way. But note one thing: in 2P-ECDSA, CoinJoin, and other similar tools, you don't have any rules, which are not checked by old nodes. They still validate a lot of things, and you don't have for example any Bitcoin signatures, which would be fake inside a CoinJoin network, or would steal coins from 2P-ECDSA, without knowing someone else's private key.

But if this actually works well, I do wonder what happens to the privacy coin narrative.

Nothing, because native privacy will be still more private, than any optional one. Even if you create a perfectly private scheme for Bitcoin, it would be limited to the small group of users, who will decide to use it. All other users will be unaffected, and will still for example reuse addresses, and compromise not only their own privacy, but also decrease the anonymity set for others.

Would you use shielded BTC yourself?

Probably not. Maybe if there will be enough poorly-protected test coins, it could be worth sweeping, to teach some people a lesson, why some schemes are unsafe. But well, today, even test coins are no longer worthless, so it is harder and harder to do it ethically, without stealing any coins.

And do you think Bitcoin should push further into privacy, or is that better left to separate coins?

It should have many features, which won't be there, because there is no consensus for that. For example, decentralized sidechains could be activated long time ago, and people could experiment with new things, without changing the base layer in any way. However, because we don't have them, they were replaced with centrally controlled federations, where you have to trust some multisig, controlled by developers, and they can be extremely fragile.

In the same way, we should have Merged Mining, implemented and supported by default, so that people could solo mine Bitcoin, and receive coins from other chains on a regular basis, while having a chance to hit a real BTC block once per lifetime or so. But instead, that idea is heavily criticized, and instead we have completely separated, and disconnected chains, where it is more profitable to mine and sell them on the spot, than mine Bitcoin directly.

There are many good ideas, which won't be there. Yet another example are "weak blocks". Maybe testnets wouldn't be even needed, if we would have them, but again: if there is no consensus, then some things simply won't happen. It is easier and much more profitable to release an altcoin, pump and dump it, and get BTCs out of it, than actually improve BTC from the start, and reach any consensus there.

[Luka123456]

Interesting proposal, but adoption is always the main hurdle for these kinds of solutions, just like we saw with Lightning. If it requires extra software or higher friction, most people simply won't bother. Plus, the regulatory pressure would likely be huge, even if it's optional

[Livingleged]

~snip~
Not really. There are many things, which could be introduced in a no-fork way. However, it doesn't automatically make it worth watching, because guess what: if something requires no forks, and introduces new rules, which are not enforced by any old nodes, then it may be possible to make a transaction, which would be valid on Bitcoin, but invalid on some subnetwork. What then?

You seemed to be really vast in bitcoin, I’m interested in knowing what happens, if a new bitcoin feature introduces rules that are not enforced by the node, how can users be sure that transactions valid under the new rule will Remain valid across the wider bitcoin network?

Will a soft work be necessary when ever a new rule need to be enforced at the bitcoin consensus level? I’m just curious to know, I’m not very good with this technical stuffs

[athanred]

how can users be sure that transactions valid under the new rule will Remain valid across the wider bitcoin network?

If it is a soft-fork, then hashrate majority will reject blocks violating new rules as invalid. If it is a no-fork, then it is just a problem of these users, using something, which is verified only by them. And then, they are solely responsible for keeping their transactions safe. If they don't, and they use it incorrectly, then their transactions can be wide open for any mining pools to be grabbed, or for any skilled users to be abused.

Will a soft work be necessary when ever a new rule need to be enforced at the bitcoin consensus level?

It depends which rule. If you want to have a sidechain, then you can just deposit some coin to a Proof of Work inside Script, and it will be enforced by all mainnet nodes, through OP_SIZE on DER signatures. See: https://bitcointalk.org/index.php?topic=5552091

Which means, that some things can be done within existing rules. But for some other things, you need a soft-fork. As always, it depends on the details. For example: transaction compression can be done without any soft-forks, just by writing a converter between the compressed and uncompressed format, similar to how Segwit nodes constantly convert all transactions between Segwit and non-Segwit versions, to follow the same network, as all pre-Segwit nodes.

I’m just curious to know, I’m not very good with this technical stuffs

Then just test it. Run regtest locally, produce some blocks, send some coins to yourself, and experiment with things on your local computer. For regtest, you don't need the whole chain, because it is mined locally on your CPU, and you can test anything you want.

In 2026, it is easier than ever, to get some knowledge, or ask any AI to write some code. Also, if you don't want to use these models, then there are still many free books you can read, about almost any well-known programming language you could ever need, for example: https://goalkicker.com/

[stompix]

What part of that block explorer output is unclear to you? You can plainly see the address the tx comes from, the address it's going to, and the USD values of each leg (2.53 in, 0.52 out).
This is a regular SegWit/Taproot tx that happens to include an unreadable OP_RETURN message. The tx is confirmed, on-chain. There's nothing "shielded" about this, and absolutely nothing even remotely similar to what happens with Lightning.

You're reading the note:
https://mempool.space/tx/5c3a5857e9fe9aa98ccb18e52b1a229fcac542caf4e46b499de8efd4bdec3751
This is the transfer:
https://mempool.space/tx/515a51d7c197d52c10a772dbd23fa401177d4d52ab758819963c33afed78fa49
This is the settlement:
https://mempool.space/tx/2e21f3f9c1241f02abf62cd1e0cf4cfeb14b8c39b3c09bfb659a6cf733faa1d4

It actually works the same way, but it's just a cumbersome and expensive way of doing things.
Also, this was just a proof of concept, it has nothing to do with the actual Shielded Bitcoin whitepaper in the OP that would work on another layer.

[Publictalk792]

What part of that block explorer output is unclear to you? You can plainly see the address the tx comes from, the address it's going to, and the USD values of each leg (2.53 in, 0.52 out).
This is a regular SegWit/Taproot tx that happens to include an unreadable OP_RETURN message. The tx is confirmed, on-chain. There's nothing "shielded" about this, and absolutely nothing even remotely similar to what happens with Lightning.

You're reading the note:
https://mempool.space/tx/5c3a5857e9fe9aa98ccb18e52b1a229fcac542caf4e46b499de8efd4bdec3751
This is the transfer:
https://mempool.space/tx/515a51d7c197d52c10a772dbd23fa401177d4d52ab758819963c33afed78fa49
This is the settlement:
https://mempool.space/tx/2e21f3f9c1241f02abf62cd1e0cf4cfeb14b8c39b3c09bfb659a6cf733faa1d4

It actually works the same way, but it's just a cumbersome and expensive way of doing things.
Also, this was just a proof of concept, it has nothing to do with the actual Shielded Bitcoin whitepaper in the OP that would work on another layer.

Checked all three transactions on mempool.space, appreciate the breakdown, but this actually reinforces the original critique rather than undoing it. Every address, every amount, and every link between the "note," "transfer," and "settlement" transactions is sitting in a public confirmed block, visible to anyone with a block explorer. If this used the same mechanism as the Shielded Bitcoin whitepaper mentions, the entire point of that mechanism would be to prevent exactly the kind of chain-following you just did to trace those three txs together.

Calling it "cumbersome and expensive" undersells the actual gap, cost and complexity are implementation problems, visibility on a public ledger is a design outcome. A real shielding layer hides the amounts and the links between transactions using something like zk-SNARKs, this doesn't hide either. Fair that it's just a proof of concept unrelated to the actual whitepaper, but that's the reason to drop the "shielded" label here entirely, not soften it.